feat(dojobay): add DojoBay app (manifest, image, catalog, ports)

2026-09-11 02:11:42 +00:00
parent db52c06a72
commit 2d41b082d7
61 changed files with 13360 additions and 3 deletions
@@ -0,0 +1,106 @@
+app:
+  id: dojobay
+  name: Dojo Bay
+  version: 1.0.0
+  upstream:
+    kind: github
+    repo: Dojobay/dojobay
+  description: Onion-only directory of public Bitcoin Dojo nodes for Samourai, Ashigaru and Sentinel wallets, with Auth47 self-service listings.
+  category: money
+
+  container:
+    build:
+      context: /opt/archipelago/docker/dojobay
+      dockerfile: Dockerfile
+      tag: localhost/archipelago-dojobay:1.0.0
+    network: archy-net
+
+  dependencies:
+    - storage: 200Mi
+
+  resources:
+    cpu_limit: 1
+    memory_limit: 256Mi
+    disk_limit: 500Mi
+
+  security:
+    capabilities: []
+    readonly_root: true
+    no_new_privileges: true
+    network_policy: bridge
+
+  ports:
+    - host: 8188
+      container: 8080
+      protocol: tcp
+      bind: 127.0.0.1
+      # open, not gated: Dojo Bay is a public directory. Anonymous Tor
+      # visitors must be able to browse listings, scan pairing QR codes and
+      # read the JSON data feed without a dashboard login challenge — that is
+      # the entire point of the site. It carries its own complete Auth47
+      # sign-in (BIP47 payment-code challenge, no accounts/passwords) that
+      # gates listing management and the admin/moderation console, the same
+      # shape Gitea and BTCPay use this policy for.
+      auth: open
+      auth_rationale: >-
+        Public onion directory: anonymous visitors must browse, pair and fetch
+        the JSON feed with no dashboard login. Listing management and admin
+        moderation are behind the app's own Auth47 (BIP47) sign-in instead.
+
+  volumes:
+    - type: bind
+      source: /var/lib/archipelago/dojobay/data
+      target: /app/data
+      options: [rw]
+    - type: bind
+      source: /var/lib/archipelago/dojobay/server-data
+      target: /app/server/data
+      options: [rw]
+    # nginx's own working files (pid, client-body/proxy temp dirs). Not
+    # persistent data — recreated on every start — hence tmpfs rather than a
+    # bind mount, and required at all only because security.readonly_root
+    # makes the rest of the image's filesystem read-only at runtime.
+    - type: tmpfs
+      target: /var/lib/nginx
+    - type: tmpfs
+      target: /var/run
+      tmpfs_options: "rw,noexec,nosuid,size=16m"
+
+  files:
+    # Archipelago's Tor daemon binds a second SocksPort on this network's
+    # bridge gateway specifically so containers can reach it (the app itself
+    # cannot resolve {{NETWORK_GATEWAY}} — only a generated file can, per
+    # docs/app-developer-guide.md). Must sit under a declared bind-mount
+    # source, hence co-located with the data volume above; the container
+    # entrypoint reads it and points the backend's outbound Tor at it.
+    - path: /var/lib/archipelago/dojobay/data/tor-proxy.conf
+      content: "{{NETWORK_GATEWAY}}:9050"
+      overwrite: true
+
+  health_check:
+    type: http
+    endpoint: http://localhost:8080
+    path: /
+    interval: 30s
+    timeout: 5s
+    retries: 3
+
+  interfaces:
+    main:
+      name: Web UI
+      description: Dojo Bay directory
+      type: ui
+      port: 8188
+      protocol: http
+      path: /
+
+  metadata:
+    icon: /assets/img/app-icons/dojobay.svg
+    repo: https://github.com/Dojobay/dojobay
+    tier: optional
+    launch:
+      open_in_new_tab: false
+    features:
+      - Onion-only directory of Bitcoin Dojo nodes
+      - Auth47 self-service listings, no accounts or passwords
+      - Automatic 24-hour and 90-day reliability tracking